CVE-2024-9264

CVE-2024-9264 is a command injection and local file inclusion flaw (CWE-94/CWE-77) in the experimental SQL Expressions feature of Grafana, in which user-supplied input passed into duckdb queries is insufficiently sanitized. Any authenticated user with VIEWER or higher permissions can trigger it by submitting a crafted SQL expression, and the attack only works when the duckdb binary is present in the Grafana server's $PATH, which is not the case in default Grafana distributions. Successful exploitation allows the attacker to execute arbitrary operating-system commands as the Grafana process and read arbitrary local files on the server, potentially exposing configuration data and data-source credentials. Only Grafana deployments that use the SQL Expressions experimental feature and have duckdb installed on the host are exploitable, although the vulnerable code path is present in the product's standard builds. There is currently no public proof-of-concept and the flaw is not listed in CISA KEV, but its EPSS score of 94.9% (100th percentile) indicates a very high probability of exploitation within 30 days.

What to do: Upgrade Grafana to the patched release identified in the Grafana Labs security advisory (exact fixed version numbers were not provided in the source data). As interim mitigations, remove the duckdb binary from the Grafana server's $PATH or disable/limit the SQL Expressions experimental feature, and restrict which VIEWER-or-higher accounts can access affected dashboards. Review server logs for unexpected duckdb invocations or anomalous local file reads to check for prior exploitation.